You are on page 1of 10


When involved in lawsuit or dispute with companies like Malibu Media or Strike 3

Holdings (two prolific filers of copyright infringement actions in the United States), or other

BitTorrent file-sharing rights holders, you may receive a letter or demand for YOU TO

PRESERVE or save evidence that may be relevant in the case. It is important that you also put

them on notice of THEIR OBLGIATION to preserve potentially relevant evidence that they and

their investigators have, store, keep and maintain (as may be applicable to the case).

Here is a sample I like to use when needed. This document cannot be used for any

commercial use and is not legal advice or a substitute for legal advice. It is a sample

document for education purposes only. It may not be current or accurate.



Matter: XXXXX




I. Introduction – Definitions & Duty


the following potentially relevant evidence must be preserved (and will ultimately need to be

produced if this case proceeds) by YOU and YOUR third party investigation companies, agents,

representative, contractors and others who may have assisted in this investigation relating to

alleged copyright infringement or other related causes of action.

“YOU” shall include all YOUR predecessors, successors, parents, divisions or affiliates,

and their respective officers, directors, agents, attorneys, accountants, employees, family members.

(collectively and hereinafter “YOU” and/or “YOUR”).

YOU are thus on notice of this demand to preserve evidence (including but not limited to

“ESI” as discussed below) and YOUR legal and ethical duty to preserve all of the following items

should be immediately communicated to YOUR agents, employees, representatives, contractors

and others who were involved in, or assisted in YOUR investigation of this matter, and as such,
this notice will be imputed to all parties to the extent permitted under the law.

II. Electronically Stored Information (“ESI”)

YOU must take any and all necessary steps to preserve all ESI that may be relevant to this

case. ESI includes, but is not limited to, any and all files, metadata, .pst files, login files, electronic

calendars, e-mails and attachments, text messages, phone records or any other electronically stored


ESI may be found in many locations, including, but not limited to, computers, cellphones,
hard drives, backup tapes, network servers, flash drives, USB drives, backup tapes, CDs, DVD’s,

remote backup services, security camera storage drives, off-site data storage locations and any other

electronic storage device or location. All evidence in these, and other locations, devices, and formats

must be immediately preserved. The failure to preserve evidence, including ESI, may result in

adverse jury instructions regarding the burden of proof and presumptions on the credibility.

Alternatively, YOU should immediately obtain forensic computer experts to take an exact

copy of all ESI in your YOUR possession, custody, or control including but not limited to YOUR

laptops, desktops, tablets, mobile phones, external storage devices, portable hard drives, external hard

drives, network attached storage devices, USB (thumb) drives, and any other device whether

mentioned herein or not, which can be used to connect to the internet, download and/or save media

files, or store electronic data (collectively, “Hard Drives”) which in any manner may be relevant to

your investigation of alleged infringement.

We will likely require YOU to provide a forensically sound image of YOUR hard drives,

computer information, information contained on devices, all reports of YOUR investigation efforts

and all other documents, whether created or stored online, in the cloud, or offline. As such, this

evidence must be preserved and any altering, deleting, or destruction of this information is strictly


III. Specific Items to be Immediately Preserved

We hereby request that YOU preserve each of the following (whether maintained or stored

online in any digital form (“electronically stored information”)[“ESI”], or offline in any physically
tangible form):

(1) All emails YOU maintain internally, or which is/was exchanged by and between YOU and YOUR


(2) All text messages YOU maintain internally or which is/was exchanged by and between YOU and

YOUR investigators;

(3) All findings and/or conclusions of YOUR investigators;

(4) All voice mails and messages YOU maintain internally or which is/was exchanged by and
between YOU and YOUR investigators;

(5) All relevant documents regarding any software product YOU use (ex. Word documents, excel

spreadsheets, reports, etc.) in regard to YOUR alleged infringement case relating to this matter;

(6) All social media posts which in any manner relate to YOUR investigation of this matter including

but not limited to (facebook, youtube, twitter, reddit, linkedin, Instagram, or other social media

posts or searches relating to the subject of YOUR copyright investigation);

(7) All information, communications (taped voice calls), and other digital documents or

communications which may be stored or maintained by YOU and/or on YOUR behalf, by any

third party, which in any manner relates to YOUR investigation or pursuit of this matter including

but not limited to any information storage provider, or “cloud” provider such as but not limited

to Amazon Cloud Drive, Apple iCloud, DropBox, Google Drive, MediaFire, Microsoft OneDrive,

OneDrive, SpiderOak and any other third party provider;

(8) All documents produced and results of all third party software that may have been used by YOU

or on YOUR behalf which was or continues to be used in the investigation or pursuit of this

matter, including but not limited to any software results, information, conclusions, or data relating

to IPP or UGG investigation results and reports, Maxmind results and reports, Wireshark results

and reports and the results, reports and conclusions of any other third party investigator and

analyzer YOU use or have used in the investigation and pursuit of this matter.

(9) Any “alerts or warnings” YOU may have been provided to the alleged infringer (subject of YOUR

infringement investigation) including but not limited to what was previously known as, the ISP’s
Copyright Alert System (“CAS”), and the Digital Millennium Copyright Act (“DMCA”), for

example “takedown” or other notices.

(10) All PCAP files collected stored or maintained in regard to YOUR alleged infringement;

(11) All .torrent files collected stored or maintained in regard to YOUR alleged infringement;

(12) All control copies of the copyrighted works which correlate to each of the infringing files

alleged to have been downloaded and/or distributed by the alleged infringer (i.e. comparing the

alleged downloads to the alleged infringing works);

(13) Any evidence relating to any social media investigation by YOU of the alleged infringers

Youtube page, Twitter page, LinkedIn page, Facebook page, or any other social media website or

channel of the alleged infringer (including all posts, “likes” or updates) which YOU may have


(14) Any evidence relating to ALL DOWNLOADS of the alleged infringer (including

downloads or sharing of files NOT related to YOUR protected works but those of another party

(for example, if YOU will contend that the alleged infringer downloaded movies, software, files,

or content belonging to a Third-Party (not YOUR company) preserve evidence of all such


(15) Copies of all contents relating to each “hash file” pertaining to alleged illegal file sharing;

(16) All capture log files;

(17) All proof of registered copyrights (alleged to have been infringed) must be preserved;

(18) All declarations and deposition transcripts (of any third party) that has been used in any

Court or other legal proceeding by YOU;

(19) Last two years financial accounting records and federal tax returns for YOU. The records

should be from two years prior to the first discovery of the alleged infringing acts;

(20) All Investigation DUID/DHCP (Unique Identifier number) evidence;

(21) All background records, searches and investigations conducted by YOU as to the alleged

infringer, their background, assets, and social media searches including but not limited to google

(22) All copies of YOUR investigator manuals dictating policy for how an investigation into

alleged copyright infringement or file sharing is to be conducted;

(23) All agreements with third party “tube” sites (any online free porn sharing) sites and any

videos freely shared with these sites; All documents concerning any damages YOU claim to have

suffered, including but not limited to costs of shooting videos, editing, and other overhead;

(24) All documents any of YOUR investigator(s) rely on, or have relied on, for the basis their
declarations which have been made in any court or legal proceeding;

(25) Evidence of any and all other judgments (including judgements obtained and denied)

involving YOUR Works at issue in regard to this matter;

(26) All evidence of enforcement and mitigation efforts to make sure YOUR movie files are not

shared online;

(27) All evidence of YOUR compliance with state and federal laws to prevent exploitation of

underage kids in regard to each movie title you allege has been infringed;

(28) All other electronic data to be preserved: this list is not exclusive and is intended only to

describe the most obvious categories of ESI that should be preserved. At a minimum, the

following types of ESI should be preserved on any and all computers your clients owned, leased,

used, or have in their possession, custody or control. Including any other:

(a) Digital Communications, such as, E-mail, Voice mail, and Instant messaging;

(b) Image and Facsimile Files, such as .PDF, .JPG;

(c) Contact and Calendar Data, such as Outlook Software;


(d) Online Access Data, such as Temporary Internet files and History.

IV. Notice of Specific Safeguards to Take

The following safeguards against destruction of evidence, at a minimum, should be

maintained until the final resolution of this matter:

A. Activity Log: YOU should maintain an activity log to document any modifications made to

any electronic data processing system that may affect the system’s capability to process

any electronic data meeting the criteria listed above, regardless of whether such

modifications were made by employees, contractors, vendors and/or any other third parties

B. Do not install/uninstall software: YOU must preserve all copies of all application programs

and utilities that may be used to process electronic data covered by this letter.

C. On-Line Data Storage on Mainframes and Minicomputers: With regard to online storage

and or direct access storage devices attached to any and all Defendants’ mainframe

computers and or mini computers: any electronic data files existing at the time of this

letter’s delivery which meet any criterion set forth above should not be modified or deleted

unless a true and correct copy of each such electronic data file has been made and steps

have been taken to ensure that the copy will be preserved and accessible for purposes of

this litigation.

D. Off-Line Data Storage, Backups and Archives, Floppy Diskettes, Tape and Other

Removable Electronic Media: With regard to all electronic media used for off-line storage,

including magnetic tapes and cartridges and other media that, at the time of this letter’s

delivery, contained any electronic data meeting the criteria listed above. YOU must

immediately stop any activity that may result in the loss of such electronic data, including

computer systems, magnetic tapes and cartridges, magneto optical disks, floppy diskettes,

and other media, whether used with personal computers, minicomputers or mainframes or

other computers, and whether containing backup and or archive data sets and other

electronic data, for all of Defendants’ computer systems.

E. Replacement of Data Storage Devices: YOU should not dispose of any electronic data

storage devices and or media which would otherwise be replaced due to failure and or

upgrade and or other reasons. Regardless of failure, upgrade or other reasons, all such data
storage devices should be maintained for inspection.

F. Fixed Drives on Stand-Alone Personal Computers and Network Workstations: With regard

to electronic data storage devices meeting any criterion listed in the paragraphs above,

which existed on fixed drives attached to stand-alone microcomputers and or network

workstations at the time of this letter’s delivery: YOU must not alter or erase such

electronic data or perform other procedures (such as data compression and disc

defragmentation or optimization routines) that may impact such data unless a true and
correct copy has been made of such active files and of completely restored versions of such

deleted electronic files and the file fragments, copies have been made of all directory

listings (including hidden files) for all directories and sub directories containing such files,

and arrangements have been made to preserve copies in an accessible format during the

pendency of this matter.

G. YOU must refrain from deleting, destroying or altering any data stored or contained within

any of YOUR hard drives, thumb drives or other information storage devices;

H. YOU should not engage in any using or attempting to use any data shredding, overwriting,

or wiping applications of any kind to alter, destroy or delete any of YOUR investigation

information that relates to this matter;

I. YOU should not engage in any defragmenting, or attempting to defragment any of YOUR

hard drives or discs that deal with any of YOUR investigation information that relates to

this matter;

J. YOU should not engage in any replacing any of YOUR hard drives or other devices that

store relevant information that deal with YOUR investigation of this matter;

K. YOU should not engage in any compressing, or attempting to compress any hard drives,

discs, or devices that deal with any of YOUR investigation informant that relates to this


L. YOU should not engage in any deleting or attempting to delete any internet cookies on any

of YOUR computers, laptops or other devices that store or maintain relevant data or deal
with any of YOUR investigation information that relates to this matter;

M. YOU should not engage in any deleting any browser history (and favorites) on any

computers, laptops or other devices that were/are used in the investigation of alleged

infringement and which in any manner deal with YOUR allegations of infringement in this


N. YOU should not engage in any running or attempting to run any “disk clean-up” processes

on any computers, laptops or other devices that pertain or relate to YOUR investigation
and information that relates to this matter;

O. YOU should not engage in any installing and/or uninstalling (or attempting to do so) any

of YOUR software on any hard drives, software programs, applications, mobile devices or

other technology on any computers, laptops or other devices used in the investigation of

alleged infringement in this matter;

P. YOU should not engage in any updating or attempting to update any operating system(s)

on any hard drives, devices, computers, laptops, tablets or other technological devices on

any computers, laptops or other devices that deals with any of YOUR investigation

information that relates to this matter;

Q. YOU should not engage in any taking any actions inconsistent with YOUR legal and ethical

duties to preserve relevant evidence including preserving all electronically stored evidence

which includes but is not limited to all WRITINGS, DOCUMENTS,


YOU (hereinafter “ESI”)


We hereby demand that YOU and anyone working on YOUR behalf not destroy, conceal,

or alter any such hard copy or electronic information related to and potentially relevant to the

subject matter of this case.

Evidence Created Subsequent To This Letter: With regard to electronic data or physical

evidence created subsequent to the date of delivery of this letter, relevant evidence must not be
destroyed by YOU and YOU must take whatever steps are appropriate to avoid destruction of


Please be advised that we will be diligently searching for any deletion or other impropriety

in their computer systems or in the documents themselves. Should YOU fail to properly preserve

evidence or other information or documents relevant to this action, we will seek the maximum

possible sanctions for spoliation and destruction of evidence, which can include and adverse jury

inference, judgment as a matter of law, monetary fines and an award of our attorneys’ fees.

Spoliation of evidence may result in evidentiary, monetary, or tort claims (based on

criminal violations) against Defendants. (Cedars-Sinai Medical Center v. Superior Court (1998)

18 Cal.4th 1, 11-13.). If the electronic discovery is not available because it was erased or otherwise

not preserved, your clients will be subject to sanctions regarding the substance of the information

deleted. (See In Re Napster, Inc. Copyright Litigation (N.D. Cal. 2006) 460 F.Supp.2nd 1060,

1077 – 1078.) Even Defendants’ attorneys have the duty to institute and maintain the litigation

hold. (Zubulake v. UBS Warburg LLC (S.D.N.Y. 2004) 229 F.R.D. 422, 433.).

Please confirm in writing immediately upon receipt of this letter, that you and your clients

have taken the steps outlined in this letter to preserve the evidence in this case. If you have any

questions of concerns, please contact me by email at the address on this letter.

Very Truly yours,


Dated: _________________